Archive
October 2019
Vulnerabilities first published in this month (UTC), newest first.
182 results · Clear filters · Feed
-
High 7.5
JFinal file validation vulnerability
In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not…
-
High 7.5
Improper Authentication in Auth0.AuthenticationApi
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.
-
High 7.5
DOS attack in Pillow when processing specially crafted image files
An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.207…
-
High 7.8
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0…
-
High 7.5
user/group information can be corrupted across storing in fsimage and reading back from fsimage
In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5. Use…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.…
-
High 8.8
android-gif-drawable Double Free vulnerability
A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arb…
-
High 8.5
Dynamic modification of RPyC service due to missing security check
In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
-
High 7.5
The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.
-
High 7.5
The BGP parser in tcpdump before 4.9.3 allows stack consumption in print-bgp.c:bgp_attr_print() because of unlimited re…
-
High 7.0CVE-2018-14879 Public exploit
The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().
-
High 7.5
The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().
-
High 7.5
The FRF.16 parser in tcpdump before 4.9.3 has a buffer over-read in print-fr.c:mfr_print().
-
High 7.5
The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).
-
High 7.5
The RSVP parser in tcpdump before 4.9.3 has a buffer over-read in print-rsvp.c:rsvp_obj_print().
-
High 7.5
The ICMP parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp.c:icmp_print().
-
High 7.5
The LDP parser in tcpdump before 4.9.3 has a buffer over-read in print-ldp.c:ldp_tlv_print().
-
High 8.8
IBM Security Guardium 9.0, 9.5, and 10.6 are vulnerable to a privilege escalation which could allow an authenticated us…
-
High 8.6
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a reload of an affected dev…
-
High 7.7
Cisco FTD, FMC, and FXOS Software Pluggable Authentication Module Denial of Service Vulnerability
A vulnerability in the configuration of the Pluggable Authentication Module (PAM) used in Cisco Firepower Threat Defense (FTD) Software, Cisco Firepower Management Center (FMC) Software, and Cisco FXOS Software could allow an authenticated, remote attacker to…
-
High 8.8
Cisco FXOS Software and Firepower Threat Defense Software Command Injection Vulnerabilities
Multiple vulnerabilities in the CLI of Cisco FXOS Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute commands on the underlying operating system (OS) with root privileges. These vulnerabilities a…
-
High 7.5
Cisco Firepower Management Center Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. The vulnerability is du…
-
High 7.2
Cisco Firepower Management Center Command Injection Vulnerability
A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with the privileges of the root user of the underlying operating system. The vulnerabilit…
-
High 8.8
Cisco Firepower Management Center Remote Code Execution Vulnerability
A vulnerability in the web UI of the Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploi…
